Privacy Policy

Effective date: 13 July 2026

1. Who we are

Angvlar Security Awareness is operated by Angvlar SRL, EU VAT ID RO40474720, CUI 40331941, D-U-N-S Number 52-539-4231, registered at str. Vidraru 1-3, bl. C6, sc. 1, ap. 55, Romania.

2. Our data-protection roles

For customer account, billing, platform security, contractual communication and our own website administration, Angvlar generally acts as a data controller. For employee audience data, campaign events, training results and reports processed solely on a customer’s documented instructions, the customer generally acts as controller and Angvlar acts as processor. The actual role depends on the specific processing activity and the signed agreement.

3. Personal data we may process

• Business account information: name, work email, role, organisation and authentication records.
• Customer contacts and authorised representatives.
• Campaign audience data supplied by the customer, such as name, work email, department, role, location, manager or tags.
• Educational event data, such as delivery status, interaction, report, simulated submission and training completion.
• Security and audit information, including login records, role, action, timestamp, IP address or pseudonymised IP reference, user agent and privacy-safe metadata.
• Support correspondence and information required to investigate incidents.

4. Data we are designed not to collect

The platform must not store passwords, one-time authentication codes, payment-card or banking data, identity documents, API keys, access tokens or other credentials entered into a simulated page. A simulated form records only the educational event, not the value entered.

5. Purposes and legal bases

Depending on the context, processing is based on performance of a contract, legitimate interests in operating and securing a B2B service, compliance with legal obligations, or the customer’s documented instructions as controller. Customers are responsible for determining and communicating the lawful basis applicable to their employees and campaigns.

6. Recipients and subprocessors

Personal data may be accessed by authorised Angvlar personnel and service providers that support hosting, email delivery, security, storage, monitoring or support, subject to appropriate confidentiality and data-protection obligations. The current public Subprocessors page and the customer agreement provide the authoritative disclosures applicable to a customer.

7. International transfers

Where personal data is transferred outside the European Economic Area, Angvlar uses an applicable transfer mechanism and supplementary safeguards where required, such as an adequacy decision or approved contractual clauses.

8. Retention

Detailed campaign events are retained for the period configured in the customer workspace or agreed contract, after which they may be anonymised or deleted. Aggregated reports and signed legal records may be retained longer where required for contractual, security, evidentiary or legal purposes. Audit data is minimised and retained according to legitimate compliance and security needs.

9. Security

Safeguards include tenant isolation, role-based access, server-side permission checks, domain verification, campaign launch gates, encryption in transit, secure session controls, audit logging, restricted uploads, tokenised public links and privacy-conscious tracking.

10. Individual rights

Depending on applicable law, individuals may have rights of access, correction, deletion, restriction, objection, portability and complaint to a supervisory authority. For campaign or employee data controlled by a customer, requests should normally be directed first to that customer. Angvlar assists customers as required by the Data Processing Agreement.

11. Cookies and local storage

The authenticated application may use strictly necessary session and security technologies. Any optional analytics or non-essential technologies must be disclosed and enabled in accordance with applicable requirements.

12. Contact and complaints

Privacy enquiries may be sent using the details in the customer agreement or the public Contact page. Individuals may also lodge a complaint with the competent data-protection authority.